Hi all,
I am seeing the strange issue on only Windows server 2008. On Windows
Server 2003 this works fine. This is mini filter driver.
I am certain that data is being returned to me from the cache as data on
the disk is encrypted and in the cache its clear and yes i made sure
that data on the disk is encrypted.
In the “Pre Read”, i want to read the data from the disk directly, even
if caching is enabled on the file.
As per MSDN documentation “Minifilter drivers can set
FLTFL_IO_OPERATION_NON_CACHED flag to specify a noncached read, even if
the file object was not opened with FILE_NO_INTERMEDIATE_BUFFERING.”
So i am using the same file object and trying to perform the “non_cached
IO” by setting this flag. But data being returned to me is from the
cache instead of disk.
This happens in the following scenario only.
Setup: I have two Windows Server 2008 system. Target system has my
driver installed and client system is mapping the drive on the target
system to pick up the data. Client system do not have any of my
component installed. Client system just maps the drive on the target
system and accesses the files.
* The client Windows 2008 system opened the file on mapped drive. So
when this request comes to the target system (where my driver is
installed) i try to perform “non-cache IO”. See the stack below on the
target system request is coming from srv2.
AND
* if someone else has opened the same file previously with cache enabled.
If this file is not previously opened then everything works as normal
and the data being returned to me is from the disk.
It only happens when the drive is mapped. When i try to do the same
operation locally everything works fine.
So i though may be something in the FO, so I tried to create the new
fileobject with “FILE_NO_INTERMEDIATE_BUFFERING” flag, still i was
getting the data back from the cache. Code snippet is below for creating
the new FO and reading.
Just for more information.
Here is the stack
fffffa6004b3c830 fffffa6000dd5ad1 myfiltr!PreOp+0x11f
fffffa6004b3c8b0 fffffa6000d9b765 fltmgr!FltvPreOperation+0x81
fffffa6004b3c960 fffffa6000d9c622 fltmgr!FltpPerformPreCallbacks+0x285
fffffa6004b3ca40 fffffa6000d9a0c5 fltmgr!FltpPassThrough+0x292
fffffa6004b3cae0 fffff80001e7658a fltmgr!FltpDispatch+0xb5
fffffa6004b3cb40 fffffa6000f6402e nt!IovCallDriver+0x34a
fffffa6004b3cb80 fffffa6000f64a57 SiWinAcc+0x102e
fffffa6004b3cbb0 fffff80001e7658a SiWinAcc+0x1a57
fffffa6004b3cc20 fffffa60041c6c00 nt!IovCallDriver+0x34a
fffffa6004b3cc60 fffffa60041c78b8 srv2!Smb2RestartNonMdlRead+0x3c0
fffffa6004b3cce0 fffffa60041d4d95 srv2!Smb2ContinueMdlRead+0x68
fffffa6004b3cd10 fffff80001c76f87 srv2!SrvProcWorkerThread+0x175
fffffa6004b3cd50 fffff80001aa9656 nt!PspSystemThreadStartup+0x57
fffffa6004b3cd80 0000000000000000 nt!KiStartSystemThread+0x16
Code:
// Set full filename
RtlCopyUnicodeString(&FileName, &pMountInfo->VolumeName);
RtlAppendUnicodeStringToString(&FileName, &pNode->Name);
// Initialize filename
InitializeObjectAttributes(
&ObjectAttributes,&FileName,OBJ_KERNEL_HANDLE,
NULL,NULL);
// Open helper file object
Status = FltCreateFile( FltObjects->Filter,FltObjects->Instance,
&FileHandle, GENERIC_READ,&ObjectAttributes,
&IoStatus,0,FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ | FILE_SHARE_WRITE,
FILE_OPEN, FILE_NO_INTERMEDIATE_BUFFERING,
NULL,
0,IO_IGNORE_SHARE_ACCESS_CHECK);
if ( !NT_SUCCESS( Status ) )
{
LEAVE;
}
Status = ObReferenceObjectByHandle(FileHandle,0,
NULL,KernelMode,(PVOID *) &pFileObject, NULL);
if ( !NT_SUCCESS( Status ) )
{
LEAVE;
}
//
// now we have the file object…
// read from the file object…
//
OffsetForReEncrypt.QuadPart = Offset;
//
// Read the data here
//
Status = FltReadFile(FltObjects->Instance,
pFileObject,
&OffsetForReEncrypt,
Length,
usrBuf,
FLTFL_IO_OPERATION_NON_CACHED,
pBytesRW, NULL, NULL);
if (!NT_SUCCESS(Status)) {
LEAVE;
}